Documentation
¶
Overview ¶
Package registry is the thin domain layer of `d8 cr` on top of go-containerregistry/pkg/v1/*. It replaces the upstream pkg/crane facade - we own every entry point, error message and option default.
Index ¶
- func Fetch(ctx context.Context, ref string, opts *Options) (v1.Image, error)
- func FetchConfig(ctx context.Context, ref string, opts *Options) ([]byte, error)
- func FetchDescriptor(ctx context.Context, ref string, opts *Options) (*remote.Descriptor, error)
- func FetchDigest(ctx context.Context, ref string, opts *Options) (string, error)
- func FetchManifest(ctx context.Context, ref string, opts *Options) ([]byte, error)
- func InsecureTransport() http.RoundTripper
- func ListCatalog(ctx context.Context, regRef string, opts *Options, ...) error
- func ListTags(ctx context.Context, repoRef string, opts *Options, ...) error
- func NewStaticKeychain(username, password string) authn.Keychain
- func Push(ctx context.Context, ref string, obj partial.WithRawManifest, opts *Options) (v1.Hash, error)
- type LoginResult
- type Options
- func (o *Options) WithContext(ctx context.Context) *Options
- func (o *Options) WithInsecure() *Options
- func (o *Options) WithKeychain(kc authn.Keychain) *Options
- func (o *Options) WithNondistributable() *Options
- func (o *Options) WithPlatform(p *v1.Platform) *Options
- func (o *Options) WithTransport(t http.RoundTripper) *Options
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Fetch ¶
Fetch resolves ref and returns a v1.Image. For multi-arch indices remote.Image picks the current runtime platform unless opts.Platform pins another one.
func FetchConfig ¶
FetchConfig returns the config JSON for ref. Multi-arch indices are resolved via the caller's platform (set on Options).
func FetchDescriptor ¶
FetchDescriptor returns the raw remote descriptor, leaving media-type dispatch to the caller (pull uses it to tell an index from an image).
func FetchDigest ¶
FetchDigest returns "sha256:<hex>" for ref's manifest as served.
func FetchManifest ¶
FetchManifest returns the raw manifest bytes as the registry served them. This preserves signatures and byte-for-byte JSON the user may want to pipe.
func InsecureTransport ¶
func InsecureTransport() http.RoundTripper
InsecureTransport returns a fresh http.Transport cloned from remote's default with TLS verification disabled. Use only when the user explicitly opts in via --insecure.
func ListCatalog ¶
func ListCatalog(ctx context.Context, regRef string, opts *Options, visit func(repos []string) error) error
ListCatalog invokes visit for every repository page on the given registry. Not every registry implements /v2/_catalog - the underlying call will surface a 404 through the error chain.
func ListTags ¶
func ListTags(ctx context.Context, repoRef string, opts *Options, visit func(tags []string) error) error
ListTags invokes visit for every tag page of repo. Stopping early: return a non-nil error (context.Canceled is reasonable for user abort).
func NewStaticKeychain ¶ added in v0.30.18
NewStaticKeychain returns a keychain that always resolves to the given username/password, regardless of the target registry.
Types ¶
type LoginResult ¶ added in v0.30.18
type LoginResult struct {
// ServerAddress is the key the credentials were stored under. For Docker
// Hub this is the canonical "https://index.docker.io/v1/".
ServerAddress string
// ConfigFile is the path to the Docker config the credentials were
// written to (or the backing file of the active credential store).
ConfigFile string
}
LoginResult reports where the credentials ended up so the caller can tell the user which file/store now holds them.
func Login ¶ added in v0.30.18
func Login(ctx context.Context, host, username, password string, opts *Options) (*LoginResult, error)
Login verifies username/password against host and, on success, persists them into the Docker config (the same store authn.DefaultKeychain reads), so every other cr command can authenticate transparently afterwards.
An empty host targets Docker Hub. Verification builds the registry's auth transport and then performs an authenticated GET /v2/: a rejected login answers 401 there, so invalid credentials fail rather than silently writing a broken config. (The transport handshake alone only validates bearer-token registries; the explicit /v2/ probe is what also covers basic-auth ones.)
type Options ¶
type Options struct {
Remote []remote.Option
Name []name.Option
Platform *v1.Platform
Keychain authn.Keychain
Context context.Context
// Transport mirrors the http.RoundTripper installed via WithTransport.
// remote.* receives it through o.Remote; we also keep a direct handle so
// auth-only flows (e.g. Login) that talk to the registry transport
// package can honour --insecure without re-deriving it from o.Remote.
Transport http.RoundTripper
}
Options accumulates everything the domain layer needs to talk to a registry: auth, transport, platform hint, name-parsing flags. Each builder mutates the receiver and returns it so calls chain.
The two slices (Remote, Name) are what actually gets passed to go-containerregistry: Remote to remote.*, Name to name.ParseReference / name.NewRepository / name.NewRegistry / name.NewTag.
func New ¶
func New() *Options
New returns Options seeded with the default Docker keychain and a background context. Keychain / platform / context are NOT baked into o.Remote here - they are finalized lazily by remoteWithContext at fetch time so repeated builder calls (e.g. WithPlatform twice with different values) cannot stack duplicate options on the slice.
func (*Options) WithContext ¶
WithContext replaces the ambient context.
func (*Options) WithInsecure ¶
WithInsecure tolerates non-TLS references during name parsing. The HTTP transport itself is configured separately via WithTransport.
func (*Options) WithKeychain ¶
WithKeychain replaces the keychain that authenticates registry calls. Last call wins.
func (*Options) WithNondistributable ¶
WithNondistributable allows pushing foreign (non-distributable) layers.
func (*Options) WithPlatform ¶
WithPlatform pins a target platform for multi-arch indices. Nil is a no-op (so a flag-driven caller can pass the parsed result directly without branching). Last non-nil call wins.
func (*Options) WithTransport ¶
func (o *Options) WithTransport(t http.RoundTripper) *Options
WithTransport installs a custom HTTP transport (typically a clone of remote.DefaultTransport with TLS skip-verify toggled).
Source Files